Dangerous new GoSerpent malware is apparently on the hunt for government secrets

Date:
Fri, 17 Jul 2026 15:05:00 +0000

Description:
The malware has been hiding in plain sight for half a decade, stealing all sorts of valuable secrets.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Kaspersky uncovers GoSerpent, a longrunning campaign on Southeast Asian government systems using a backdoor, RAT (Stowaway), and exfiltration tool (TmcLoader) Attackers showed extreme patience, waiting weeks before deploying secondary tools to evade detection and outlast log retention policies Attribution remains uncertain, but
overlaps with past TetrisPhantom operations; defenders are urged to review shared IoCs to detect compromise Security researchers Kaspersky discovered a five-year-old piece of malware thats been hiding on government computers in the Southeast Asian region, harvesting secrets and other actionable intelligence.

The company analyzed a campaign called GoSerpent, which comprises of a backdoor of the same name, a Remote Access Trojan (RAT) called Stowaway, and
a two-stage data exfiltration tool called TmcLoader. The backdoor was first used in 2021, it was said, meaning it was successfully hiding for half a decade. This was achieved, among other things, with plenty of patience and careful planning. Latest Videos From Watch full video here: TetrisPhantom
What stands out about GoSerpent is the deliberate dwell time, Noushin Shabab, Lead Security Researcher in Kaspersky GReAT, explained.

Usually, attackers want to move quickly once they get a foothold, but this group drops the initial backdoor and waits. They let the dust settle for
weeks before deploying their secondary exfiltration tools like TmcLoader.
That kind of patience is a calculated move designed to outlast standard log retention policies and automated security sweeps, making it incredibly difficult for defenders to connect the initial infection to the eventual data theft." You may like Experts warn hackers are hiding malware inside Google's own ad systems here's what we know 'Infrastructure rotates and payloads can change, but the execution model persists': Chinese hackers return to target victims across Asia with new MustangPanda threat This macOS malware can avoid AI analysis with gaslighting prompts hidden inside its architecture

The researchers could not conclusively attribute this campaign to any particular threat actor but did say that it has a lot in common with older campaigns conducted by the TetrisPhantom actor, including victimology, technical capabilities, and operational methods.

Kaspersky analyzed TetrisPhantom back in 2023, when it saw the group compromising secure USB drives used to provide encryption for safe data storage. This campaign also targeted government entities in the Asia-Pacific region (APAC) but, at the time, it was a newly discovered threat actor with
no overlap with other known groups. Are you a pro? Subscribe to our
newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. The
best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/dangerous-new-goserpent-malware-is-appa rently-on-the-hunt-for-government-secrets


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)